236280 - Browser segfaults on page update using page provided "refresh" button (javascript problem???)

Status: RESOLVED DUPLICATE of bug 225868

(Core :: Layout, defect)

Description

[ongakugainochi]

User-Agent:       
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040207 Firefox/0.8

www.activeui.net provides a set of dhtml widgets that are cross browser 
compatible. The widgets in and of themselves display fine
(cf the "grid" widget on www.activeui.net). 
In their documentation, they provide "live" examples where the source can be
edited, changed, updated, etc. (Changing text to be displayed, etc.)
When done, a "refresh" button is clicked to display "live" 
the changes made. Clicking this button causes a segfault in the browser every
time (tested in mozilla 1.6, firefox 0.8, mozilla 1.7a on linux, running kernel
2.6.3. Also tested on windows98+firefox 0.8 with the same result; windows gives:
FIREFOX caused an invalid page fault in module FIREFOX.eXE at 017f:0066d3a2.).
Furthermore, on occasion, even just loading the provided URL can crash the
browser, but this behavior is sporadic.

Reproducible: Always
Steps to Reproduce:
1. Load provided URL (or any of said site's "documentation" pages with "live"
demo's)
2. Click the "refresh" button



Actual Results:  
Mozilla crashed

Expected Results:  
"refreshed" the page

(see above, but, firefox caused an invalid page fault in module firefox.exe at
017f:0066d3a2

Comment 1

[Sean Umphlet (nosebleed)]

works for me

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040308

Comment 2

[logan]

Confirmed on:

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040309 Firefox/0.8.0+
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7a) Gecko/20040218

I'm using mozilla provided bins, so no symbols...

#0  0x400ea760 in raise () from /lib/tls/libpthread.so.0
#1  0x415f2738 in ?? () from /usr/local/mozilla-1.7a/components/libprofile.so
#2  0x0000000b in ?? ()
#3  0x415f0408 in NSGetModule ()
   from /usr/local/mozilla-1.7a/components/libprofile.so
#4  <signal handler called>
#5  0x408e52ba in NSGetModule ()
   from /usr/local/mozilla-1.7a/components/libgklayout.so
...
#28 0x4084f27f in NSGetModule ()
   from /usr/local/mozilla-1.7a/components/libgklayout.so
#29 0x405cc067 in PL_HandleEvent () from /usr/local/mozilla-1.7a/libxpcom.so
#30 0x405cbf94 in PL_ProcessPendingEvents ()
   from /usr/local/mozilla-1.7a/libxpcom.so
...

Comment 3

[logan]

Also see it on todays build..

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040309

Comment 4

[Vidar Haarr (not reading bugmail)]

Crashes for me on WinXP SP1 trunk 2004030509.

Comment 5

[Felix Miata]

Crash for me in today's Linux trunk.

Comment 6

[Andreas Kunz]

Stack of WinXP debug build, about a week old.
The source line is 
  nsresult rv = child->GetPrefSize(aBoxLayoutState, aSize);
child is null).
This might be bug 225868.

	gklayout.dll!nsScrollBoxFrame::GetPrefSize(nsBoxLayoutState &
aBoxLayoutState={...}, nsSize & aSize={...})  Line 538 + 0xb	C++
 	gklayout.dll!nsGfxScrollFrame::GetPrefSize(nsBoxLayoutState & aState={...},
nsSize & aSize={...})  Line 724 + 0x20	C++
 	gklayout.dll!nsBoxFrame::Reflow(nsIPresContext * aPresContext=0x03cfd3d8,
nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState &
aReflowState={...}, unsigned int & aStatus=0)  Line 828	C++
 	gklayout.dll!nsGfxScrollFrame::Reflow(nsIPresContext *
aPresContext=0x03cfd3d8, nsHTMLReflowMetrics & aDesiredSize={...}, const
nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 823 +
0x19	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x03d1e480,
nsIPresContext * aPresContext=0x03cfd3d8, nsHTMLReflowMetrics &
aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int
aY=0, unsigned int aFlags=0, unsigned int & aStatus=0)  Line 935 + 0x1f	C++
 	gklayout.dll!CanvasFrame::Reflow(nsIPresContext * aPresContext=0x03cfd3d8,
nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState &
aReflowState={...}, unsigned int & aStatus=0)  Line 563	C++
 	gklayout.dll!nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState & aState={...},
nsIPresContext * aPresContext=0x03cfd3d8, nsHTMLReflowMetrics &
aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int &
aStatus=0, int aX=0, int aY=0, int aWidth=4500, int aHeight=345, int
aMoveFrame=1)  Line 880	C++
 	gklayout.dll!nsBoxToBlockAdaptor::DoLayout(nsBoxLayoutState & aState={...}) 
Line 626 + 0x2e	C++
 	gklayout.dll!nsBox::Layout(nsBoxLayoutState & aState={...})  Line 994	C++
 	gklayout.dll!nsScrollBoxFrame::DoLayout(nsBoxLayoutState & aState={...}) 
Line 337	C++
 	gklayout.dll!nsBox::Layout(nsBoxLayoutState & aState={...})  Line 994	C++
 	gklayout.dll!nsContainerBox::LayoutChildAt(nsBoxLayoutState & aState={...},
nsIBox * aBox=0x03cff338, const nsRect & aRect={...})  Line 650 + 0x10	C++
 	gklayout.dll!nsGfxScrollFrameInner::LayoutBox(nsBoxLayoutState & aState={...},
nsIBox * aBox=0x03cff338, const nsRect & aRect={...})  Line 1205 + 0x11	C++
 	gklayout.dll!nsGfxScrollFrameInner::Layout(nsBoxLayoutState & aState={...})
 Line 1355	C++
 	gklayout.dll!nsGfxScrollFrame::DoLayout(nsBoxLayoutState & aState={...})  Line
1213 + 0xf	C++
 	gklayout.dll!nsBox::Layout(nsBoxLayoutState & aState={...})  Line 994	C++
 	gklayout.dll!nsBoxFrame::Reflow(nsIPresContext * aPresContext=0x03cfd3d8,
nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState &
aReflowState={...}, unsigned int & aStatus=0)  Line 868	C++
 	gklayout.dll!nsGfxScrollFrame::Reflow(nsIPresContext *
aPresContext=0x03cfd3d8, nsHTMLReflowMetrics & aDesiredSize={...}, const
nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 823 +
0x19	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x03cff1f0,
nsIPresContext * aPresContext=0x03cfd3d8, nsHTMLReflowMetrics &
aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int
aY=0, unsigned int aFlags=0, unsigned int & aStatus=0)  Line 935 + 0x1f	C++
 	gklayout.dll!ViewportFrame::Reflow(nsIPresContext * aPresContext=0x03cfd3d8,
nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState &
aReflowState={...}, unsigned int & aStatus=0)  Line 248 + 0x2b	C++
 	gklayout.dll!IncrementalReflow::Dispatch(nsIPresContext *
aPresContext=0x03cfd3d8, nsHTMLReflowMetrics & aDesiredSize={...}, const nsSize
& aMaxSize={...}, nsIRenderingContext & aRendContext={...})  Line 898	C++
 	gklayout.dll!PresShell::ProcessReflowCommands(int aInterruptible=1)  Line 6434	C++
 	gklayout.dll!ReflowEvent::HandleEvent()  Line 6256	C++
 	gklayout.dll!HandlePLEvent(ReflowEvent * aEvent=0x03d682a8)  Line 6270	C++
 	xpcom.dll!008e2bdd() 	
 	xpcom.dll!008e2a9a() 	
 	xpcom.dll!008dd43c() 	
 	gkwidget.dll!nsWindow::DispatchPendingEvents()  Line 3640	C++
 	gkwidget.dll!nsWindow::ProcessMessage(unsigned int msg=514, unsigned int
wParam=0, long lParam=22216751, long * aRetValue=0x0012fbe8)  Line 4003	C++
 	gkwidget.dll!nsWindow::WindowProc(HWND__ * hWnd=0x00080828, unsigned int
msg=514, unsigned int wParam=0, long lParam=22216751)  Line 1346 + 0x1b	C++
 	user32.dll!77d13a50() 	
 	user32.dll!77d13b1f() 	
 	user32.dll!77d13d79() 	
 	SHLWAPI.DLL!70a9f1ab() 	
 	user32.dll!77d13fd4() 	
 	user32.dll!77d13ddf() 	
 	gkwidget.dll!nsAppShell::Run()  Line 135	C++
 	appshell.dll!nsAppShellService::Run()  Line 484	C++
 	mozilla.exe!main1(int argc=1, char * * argv=0x002a2638, nsISupports *
nativeApp=0x00abef60)  Line 1291 + 0x20	C++
 	mozilla.exe!main(int argc=1, char * * argv=0x002a2638)  Line 1678 + 0x25	C++
>	mozilla.exe!mainCRTStartup()  Line 338 + 0x11	C
 	kernel32.dll!77e614c7() 	
 	SHLWAPI.DLL!70a9f1ab() 	

Comment 7

[Doron Rosenberg (IBM)]

-> layout

Comment 8

[Doron Rosenberg (IBM)]

Could be a dupe of 225868, but there is only one overflow:auto in this page, no
overflow:hidden.

Comment 9

[Andreas Kunz]

dup of bug 225868
Included site.js writes a "overflow: hidden" on page load.

*** This bug has been marked as a duplicate of 225868 ***